﻿#include <windows.h>
#include <sddl.h>
#include <stdio.h>

BOOL EnablePrivilege(LPCWSTR privilege) {
    HANDLE hToken;
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken))
        return FALSE;

    TOKEN_PRIVILEGES tkp;
    if (!LookupPrivilegeValue(NULL, privilege, &tkp.Privileges[0].Luid)) {
        CloseHandle(hToken);
        return FALSE;
    }

    tkp.PrivilegeCount = 1;
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    BOOL result = AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, NULL, NULL);
    CloseHandle(hToken);
    return result;
}

BOOL CreateProcessWithSidAuth(PSID pTargetSid, LPCWSTR lpCommandLine) {
    // 获取TrustedInstaller进程句柄
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot == INVALID_HANDLE_VALUE) return FALSE;

    PROCESSENTRY32 pe = { sizeof(pe) };
    BOOL bFound = FALSE;
    HANDLE hTargetProcess = NULL;

    for (BOOL ret = Process32First(hSnapshot, &pe); ret; ret = Process32Next(hSnapshot, &pe)) {
        if (wcscmp(pe.szExeFile, L"TrustedInstaller.exe") == 0) {
            hTargetProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pe.th32ProcessID);
            if (hTargetProcess) bFound = TRUE;
            break;
        }
    }
    CloseHandle(hSnapshot);

    if (!bFound) return FALSE;

    // 获取进程令牌并验证SID
    HANDLE hToken;
    if (!OpenProcessToken(hTargetProcess, TOKEN_DUPLICATE | TOKEN_QUERY, &hToken)) {
        CloseHandle(hTargetProcess);
        return FALSE;
    }

    PTOKEN_USER pTokenUser = NULL;
    DWORD dwSize = 0;
    GetTokenInformation(hToken, TokenUser, NULL, 0, &dwSize);
    pTokenUser = (PTOKEN_USER)malloc(dwSize);
    if (!GetTokenInformation(hToken, TokenUser, pTokenUser, dwSize, &dwSize)) {
        free(pTokenUser);
        CloseHandle(hToken);
        CloseHandle(hTargetProcess);
        return FALSE;
    }

    if (!EqualSid(pTokenUser->User.Sid, pTargetSid)) {
        free(pTokenUser);
        CloseHandle(hToken);
        CloseHandle(hTargetProcess);
        return FALSE;
    }

    // 创建新进程
    HANDLE hDupToken;
    if (!DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation,
        TokenPrimary, &hDupToken)) {
        free(pTokenUser);
        CloseHandle(hToken);
        CloseHandle(hTargetProcess);
        return FALSE;
    }

    STARTUPINFOW si = { sizeof(si) };
    PROCESS_INFORMATION pi;
    BOOL bResult = CreateProcessAsUserW(hDupToken, NULL, (LPWSTR)lpCommandLine,
        NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);

    free(pTokenUser);
    CloseHandle(hDupToken);
    CloseHandle(hToken);
    CloseHandle(hTargetProcess);
    return bResult;
}

int main() {
    // 启用调试权限
    if (!EnablePrivilege(SE_DEBUG_NAME)) {
        printf("Enable privilege failed\n");
        return 1;
    }

    // 转换TrustedInstaller SID
    PSID pSid = NULL;
    if (!ConvertStringSidToSid(
        L"S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
        &pSid)) {
        printf("ConvertSid failed\n");
        return 1;
    }

    // 创建进程
    if (!CreateProcessWithSidAuth(pSid, L"cmd.exe")) {
        printf("Create process failed: %d\n", GetLastError());
        LocalFree(pSid);
        return 1;
    }

    LocalFree(pSid);
    return 0;
}
